Your cybersecurity score doesn't stay in-house. See how DFARS 7019 and 7020 put it on the record and what it takes to keep it accurate.
------------------------------------------------------------------------------------------------------------------
TL;DR: Two Defense Federal Acquisition Regulation Supplement (DFARS) clauses, 252.204-7019 and 252.204-7020, turn a shop's cybersecurity score into an official record. Before a Department of Defense (DoD) contract gets awarded, the contractor needs a current score against the National Institute of Standards and Technology (NIST) SP 800-171 requirements posted in the Supplier Performance Risk System (SPRS). That number doesn't disappear into a drawer, because DoD reads it and can come check it. An honest, current score keeps a shop in the running, while a padded or stale one can cost a contract or land a shop in legal trouble.
------------------------------------------------------------------------------------------------------------------
If you're a defense contractor, you've probably heard you need a cybersecurity score. What doesn't always get mentioned is where that score ends up. Under DFARS 252.204-7019 and 252.204-7020, it doesn't stay in a folder on your desk. It goes into a government system and sits there as the official record of how your shop is doing.
Nobody loves filling out this kind of form, and it's easy to shrug it off as more paperwork. Think about a life insurance application. You answer the health questions yourself, and nobody checks a word. The policy gets filed away and life goes on. Then a claim comes in, the insurer pulls out that application, and if one answer was off, suddenly the whole thing is in question right when somebody needs it most. Your score works the same way, with one twist. DoD doesn't have to wait for a claim. It can come check whenever it wants.
That matters more now than it did a few years ago. The Cybersecurity Maturity Model Certification (CMMC) is showing up in real contracts, and the score requirement is already part of the deal. Contracting officers look for it before the work gets awarded. A number that's missing, outdated, or a little too rosy can stop a shop at the starting line. It's a rough way to lose a contract you were already qualified to do.
It's all part of a bigger picture, too. The kind of information you handle, the CMMC level that applies, and the score on file all add up to one question. Can this contractor be trusted with the work? No single piece answers it by itself. The score is just the piece that gets a number attached.
That score is a number you report about yourself. DFARS 7019 and 7020 are what make it official, checkable, and expensive to get wrong.
DFARS clauses can read like they were written to put people to sleep, so here's the short version. These two have been showing up in solicitations and contracts since late 2020, and each one has a main job.
DFARS 252.204-7019 is the entry ticket. To be considered for an award, a contractor needs a current score posted in SPRS for the system that would handle the work. Current generally means no more than three years old. Contracting officers look for it. No score, no seat at the table, no matter how good the shop is at the work itself.
DFARS 252.204-7020 is the follow-up. It lets DoD come look at a contractor's facilities, systems, and people to see whether the score holds up. It also carries the same expectation down the chain, so a prime has to make sure its subcontractors have a score of their own too.
Both clauses sit on top of a third one, DFARS 252.204-7012, which is what requires shops to protect this information to NIST SP 800-171 standards in the first place. The first post in this series covers that bigger picture.
Put the three together and the message is simple. Protect the information, report how well you did, and let DoD check your work. That number you report lives in one specific place, and knowing how that place works makes everything else easier.
The number lives in SPRS, a DoD system that works a bit like a filing cabinet for contractor records. A shop logs in, posts its score, and that's what a contracting officer pulls up when a bid comes in. Post it once and it follows the shop around.
What goes in is a summary, not the whole story. The shop enters its score, the date of the assessment, and which system the score covers. It also lists the date it expects to have every requirement in place. The details behind the number, like the system security plan and the supporting evidence, stay with the shop. DoD can still ask to see them.
Who gets to look? Government users with the right access can. Other contractors can't pull up a competitor's score. That's a small comfort, but it's a real one. It also means the people who do see the number are exactly the ones deciding whether to hand over the contract.
The score covers the systems that handle protected government information, so the first step is knowing which information counts. The FCI vs. CUI post in this series sorts that out.
That's why the number matters so much. It's short, it's public to the people who count, and it says a lot about a shop in a few digits.
The math is simpler than it sounds. A shop starts at 110, one point for each requirement in NIST SP 800-171, and that's a perfect score. Every requirement that isn't fully in place takes points off.
Not every miss costs the same. Each requirement is worth 1, 3, or 5 points, depending on how much it matters for protecting the information. Something like multifactor authentication carries more weight than a smaller housekeeping item. Miss enough of the heavy ones and the score drops fast. It can even go negative, and the lowest possible score is negative 203. That's a lot of room to fall.
Two things are easy to miss here. The first is that the score reflects what's in place today. A plan to fix something next quarter doesn't earn points back, which is why the SPRS entry also lists the date a shop expects to reach 110. That date tells the story of where the shop is headed. The score tells where it is right now.
The second is that 7019 asks for a score, not a passing grade. A shop can post a low number and still be on the record. But a contracting officer will see it, and so will anyone else with access, so a low score tells its own story about how ready the shop is.
That's exactly why the number has to be real.
So who checks the number? That depends on which of three levels the assessment lands at.
A Basic assessment is where most shops start. It's a self-assessment. The shop goes through the requirements, scores itself, and posts the result. Nobody from DoD is in the room, and DoD takes the shop's word for it, at least for now.
A Medium assessment is a step up. DoD assessors review the shop's system security plan and supporting documentation and compare it to the score that got posted. They're checking whether the paperwork backs up the number.
A High assessment goes the deepest. Assessors look at the systems themselves, test how things are set up, and talk with the people who run them. It's a full inspection instead of a look at the files.
This is where 7020 does its work. It gives DoD the right to come in for Medium and High assessments, and it requires the shop to provide access to its facilities, systems, and people when they do. A shop doesn't get to say "not today."
The CMMC program splits assessments too, between self-assessment and third-party assessment, depending on what a shop handles, and the Level 1 vs. Level 2 post in this series explains how that works.
The number a shop posts is where the conversation starts. The Medium and High assessments are where it gets tested.
Posting the score is the easy part. Keeping it right takes some upkeep.
First, scores expire. A posted score is only current for three years, and a shop that lets it lapse is back to having nothing on file. Second, shops change. New software, a new location, a new cloud service, a problem that finally got fixed. Any of those can move the number, and the posted score should move with it. A score that was right last spring can be wrong this fall.
Then there's the temptation to round up. Nobody sets out to be dishonest. It sounds more like "we mostly have that one in place," and the number drifts up a couple of points. But a padded score isn't a rounding error. The Department of Justice has pursued contractors under the False Claims Act over misstated cybersecurity compliance, and that's a much bigger problem than a lost bid.
The score also only covers the system it was written for, so the boundary a shop draws around that system decides what's in play. A CMMC enclave is one way to keep that boundary small and clear, and the Enclave post in this series covers how.
Keeping the number accurate isn't glamorous work. It's the work that keeps the number believable.
Smaller shops often meet these clauses for the first time through a customer. A prime contractor can't hand work that involves protected information to a subcontractor until that subcontractor has a current score posted in SPRS. So the prime asks. And if the sub passes work further down the chain, the same expectation goes with it.
That means a shop doesn't need a direct DoD contract to feel this. Doing work for a prime that has one is enough. It's one more reason to have the number ready when a customer asks.
Outside providers are part of the picture too. If an IT company or a cloud service supports the systems that handle this information, it becomes part of what gets assessed, and its setup shows up in the shop's score. A shop can hand off the work, but it can't hand off the responsibility along with it.
Whether a managed service provider (MSP) counts as an external service provider (ESP), and how far one can carry CMMC for a shop, is covered in the MSP and ESP post in this series.
Between the primes, the subs, and the providers, a lot of people end up depending on one number.
DFARS 7019 and 7020 take a number a shop reports about itself and turn it into an official record. The score goes into SPRS, contracting officers look for it, and DoD can come check it whenever it decides to. It starts at 110, loses points for every requirement that isn't in place, and has to be refreshed as the shop changes. It follows the work down to subcontractors too. Like that life insurance application, it sits in the file until somebody needs to read it.
Most shops don't struggle with the idea of an official score. They struggle with the feeling that comes with it. Nobody wants to find out the number is lower than they hoped, and it's tempting to round up and hope nobody looks. Meanwhile, a prime is asking for a score, a contract is on the line, and the requirements read like they were written for a company with ten IT people. That's a lot to carry on top of the real work.
CNWR helps defense contractors put an accurate number on the record and keep it there. The team scores the shop against the requirements, builds the documentation that backs the number up, and fixes what's pulling the score down. CNWR also helps shops keep the score current as things change, so the number posted this year still matches the shop next year.
If you're not sure your score is right, or you don't have one yet, connect with CNWR to take a look at where you stand. It's a lot easier to stand behind a number you've checked.
1. Do subcontractors need a score too?
If the work involves protected government information, yes. A prime can't award that work until the subcontractor has a current score posted in SPRS, so smaller shops often hear about it first from a customer. The same goes further down the chain, so a sub that passes work along has to make sure the next shop in line has a score of its own. Having the number ready makes those conversations a lot easier.
2. Does a low score disqualify a shop?
Not under 7019 by itself. The clause requires a posted score, not a passing grade, and a shop can post a low number along with the date it expects to reach 110. That said, contracting officers can see the number, and a low one shows exactly how much work is left. Other contract requirements, including CMMC, can set a higher bar.
3. Can DoD really check the score?
Yes. Under 7020, DoD can conduct Medium and High assessments, and the shop has to provide access to its facilities, systems, and people when they do. A Medium assessment looks at whether the documentation backs up the score. A High assessment tests the systems themselves. A shop that kept its number accurate has a lot less to worry about, and one that rounded up has a real problem.